Privacy Policy

Last updated: November 11, 2026

This Privacy Policy explains how Tahoe CBD, operated by The Colony Group LLC (doing business as Tahoe CBD) ("Tahoe CBD," "we," "us" or "our"), collects, uses, shares and protects personal information, and what choices you have. We do not sell your personal information, and we do not store your card number.

1. Who We Are and What This Policy Covers

Tahoe CBD is a hemp and CBD retailer with a store at 987 Edgewood Cir, South Lake Tahoe, CA 96150, and an online store. Our website and online store are only for adults 21 or older, and we ship only to addresses in the United States.

This policy applies when you visit our website at tahoecbd.com, shop in our online store (including online orders you pick up at our store), or contact us by phone, email, contact form or in person.

Please also read our Terms of Service, Shipping Policy and Refund Policy.

2. Information You Give Us

• Orders. Your name, email address, phone number, billing address, shipping address and order details (products, quantities and prices). We also record whether you chose shipping or in-store pickup, how you chose to pay, and that you ticked our checkout box confirming you are 21 or older and agree to our Terms and policies, with the date and time.
• Customer accounts. If you create an account in our online store, your name, email address, password (stored only in a hashed form that we cannot read) and saved addresses.
• Contact form, phone and email. Your name, email address or phone number, the topic you choose and your message, plus our notes about your request. When you use our contact form, we also record the page you sent it from, your IP address and your browser type, which help us stop spam. Contact form messages are stored in our website database.
• Newsletter. Your name and email address, if you sign up.
• Age confirmation. Our website asks you to confirm that you are 21 or older before you enter and remembers your answer with a cookie (see Section 9). At checkout, you must confirm that you are 21 or older. We may also use a third-party age-verification service, which may ask for details such as information from your government ID. When you pick up an order at our store, we check a valid government photo ID showing you are 21 or older.
• Returns and customer service. Your order number, photos of a damaged or wrong item, and details about the problem.

3. Information We Collect Automatically

• Server logs and device information. When you visit, our website's servers record technical details such as your IP address, browser type and version, device type, operating system, the pages you visit, the page that sent you to us, and the date and time of your visit.
• Cookies. Our website and online store use cookies, including our age-confirmation cookie (tcs_age) and WooCommerce cart and session cookies. See Section 9.

Location check. When you add a restricted product to your cart or check out, we look up the U.S. state your IP address belongs to, using the GeoJS service, so we can stop orders from states where a product is restricted. We keep the result on our server for up to 12 hours, stored under a coded (hashed) form of your IP address, and we do not use it for advertising.

4. Information We Get From Others

• Payment processor. Whether your payment was approved, limited card details (such as card type and last four digits), fraud-screening results, and notices of chargebacks or disputes.
• Age-verification service. If we use one, whether your age was verified.
• Shipping carriers. Tracking and delivery updates, adult-signature confirmations, address corrections and notices of returned packages.

5. How We Use Your Information

• To process, ship and deliver your order, prepare in-store pickups, take payment at pickup when you choose "Pay in store at pickup," and send order confirmations and tracking numbers.
• To verify that you are 21 or older and that we can lawfully ship your products to your address.
• To answer your questions, including contact form messages, and handle returns, refunds and cancellations.
• To prevent fraud and spam, keep our website secure, and respond to chargebacks and payment disputes.
• To meet legal, tax and record-keeping duties, including collecting sales tax where required.
• To keep our website and online store working and fix errors.
• To send marketing emails, but only if you sign up for them.

6. How We Share Your Information

We share personal information with the following types of service providers, and only as needed for the purposes in Section 5:

• Website host. Our website and our online store, which runs on WooCommerce software on our own website, are hosted on servers provided by our website hosting company. Order, account and contact form information is stored in our website database on those servers.
• Payment processor and bank. Card payments go through Authorize.net (see Section 8) to our payment processor and bank. They receive payment and order details to process payments, screen for fraud and handle disputes. If you file a chargeback or other payment dispute, we give the card issuer our order, delivery and age-verification records for that order.
• Shipping carriers. USPS, UPS or FedEx receive your name, address, phone number and package details to deliver your order and, when needed, collect an adult signature.
• Age-verification provider. If we use one, it receives the details needed to confirm your age.
• Email service provider. Sends our order emails and, if you signed up, our newsletter.
• Technical providers. Help us speed up and secure our website.
• Google Maps. Our store and contact pages show an embedded Google map. When the map loads, Google receives technical information such as your IP address and browser details. See Section 9.

Our service providers may use your information only to provide services to us. The one exception is Google, which handles the information it collects through the embedded map under its own Google Privacy Policy.

We may also share personal information:

• To comply with a law, court order, subpoena or other lawful request.
• To protect the rights, property and safety of our customers, our business and others, including to investigate fraud.
• With our accountants and lawyers, who must keep it confidential.
• With a buyer or successor if we sell, merge or transfer all or part of our business.
• When you ask us to.

7. We Do Not Sell Your Personal Information

We do not sell your personal information, and we have not sold it in the past 12 months. We do not share it for cross-context behavioral advertising, meaning ads based on your activity across other companies' websites and apps. We do not rent or trade our customer or email lists.

8. How We Handle Card Payments

We accept Visa, Mastercard, American Express, Discover, JCB and Diners Club. Card payments go through Authorize.net, a Visa company that follows the Payment Card Industry Data Security Standard (PCI DSS). When you enter your card number at checkout, it goes straight from your browser to Authorize.net. Tahoe CBD never receives or stores it. We receive only limited card details, such as the card type and last four digits.

Our checkout uses Authorize.net's payment plugin. If a payment fails or the checkout has an error, the plugin may send an error report to Visa so Authorize.net can fix the problem. A report can include the order number and total, why the payment failed, the card type and last four digits, the checkout page address, the page you came from, your browser type, your IP address and the buttons you clicked. It never includes your full card number or your email address.

If you choose "Pay in store at pickup" for a pickup order, we do not collect any card details online. You pay at our store when you collect your order.

9. Cookies and How to Control Them

Cookies are small text files that a website stores in your browser. Our site uses:

• An age-confirmation cookie (tcs_age) that remembers you confirmed you are 21 or older, so we do not ask on every page. It holds no personal details and lasts 30 days.
• WooCommerce cart and session cookies (such as woocommerce_cart_hash, woocommerce_items_in_cart and wp_woocommerce_session) that keep items in your cart, remember your session and run checkout.
• Account cookies that keep you signed in, if you sign in to a customer account.
• Order-source information that WooCommerce may record at checkout, such as the website that referred you or a campaign tag in the link you followed. We may save it with your order to understand which links bring customers to our store.
• Technical cookies that our host or caching tools may set to help pages load faster and keep the site secure.
• Map cookies that Google may set when the embedded Google map loads on our store or contact page.

We do not use advertising cookies or tracking pixels, and we do not currently use analytics cookies. If we add a website analytics tool, we will update this policy first. Other than Google, through the embedded map, we do not allow third parties to collect personal information about your online activities over time and across different websites when you use our site.

Your choices. You can block or delete cookies, including third-party cookies such as Google's, in your browser settings. If you block all cookies, our cart, checkout and age check may not work properly.

10. Do Not Track and Global Privacy Control

Do Not Track. Some browsers can send a "Do Not Track" (DNT) signal. There is no common standard for how websites should respond to DNT, so our website does not currently change how it works when it receives a DNT signal.

Global Privacy Control. Global Privacy Control (GPC) is a browser setting that tells websites you want to opt out of the sale or sharing of your personal information. If your browser sends a GPC signal, we honor it as a valid request to opt out of the sale or sharing of your personal information. Since we do not sell or share personal information, you do not need to take any other step.

11. Marketing Emails and Text Messages

We send marketing emails only if you sign up for them. Every marketing email has an "unsubscribe" link. You can unsubscribe at any time with that link or by contacting us, and we honor unsubscribe requests within 10 business days. Even after you unsubscribe, we will still send service emails about your orders, such as order confirmations, shipping updates and replies to your questions.

We do not send marketing text messages. We contact you by phone only about your order, a delivery, a pickup, a return or a question you asked.

12. How Long We Keep Information

We keep personal information only as long as we need it for the purposes in this policy. We use these rules:

• Order, payment and age-verification records (including the checkout consent record and, for orders placed before November 11, 2026, the date of birth you gave at checkout): as long as tax and other laws require, and long enough to handle returns, chargebacks and disputes.
• Customer accounts: until you ask us to close your account, apart from order records we must keep.
• Customer-service messages, including contact form messages: as long as needed to help you and keep a record of your request.
• Newsletter details: until you unsubscribe. We then keep only your email address on a "do not email" list so we do not email you again.
• Privacy requests: as long as needed to show that we handled them as the law requires.
• Server logs: only as long as needed for security and troubleshooting.
• Cookies: until they expire or you delete them in your browser.

When we no longer need information, we delete it or remove the details that identify you.

13. How We Protect Information

We use reasonable administrative, technical and physical safeguards to protect personal information. Our website uses encryption (HTTPS), and we limit access to people who need it to do their jobs. No system is completely secure, so we cannot promise absolute security. If a data breach affects your personal information, we will notify you as the law requires.

14. Age Requirement and Children's Privacy

You must be 21 or older to use our website and to buy any of our products, including CBD products. We do not knowingly collect personal information from anyone under 21, and we never knowingly collect it from children under 13. If we learn that someone under 21 has given us information, we will cancel and refund any order and delete the information unless the law requires us to keep it. If you believe a minor has given us information, please contact us.

15. Your Privacy Rights and Choices

No matter where you live, you may ask us to:

• Access the personal information we have about you and get a copy;
• Correct information that is wrong or out of date;
• Delete your personal information; and
• Stop sending you marketing emails.

We may keep some information when the law requires or allows it, such as tax and order records or records needed to prevent fraud or answer a chargeback. If so, we will tell you what we kept and why.

How to make a request. Email service@tahoecbd.com or call (888) 689-1500. We will confirm that we received your request within 1 business day and respond within 45 calendar days. If we need more time, we will tell you why, and we may take up to 45 more calendar days. We do not charge a fee for these requests.

Verifying your identity. To protect you, we will ask you to match details we already have, such as your name, email address and a recent order number. We use these details only to verify your request.

Authorized agents. Someone else may make a request for you if they give us your signed, written permission. We may also ask you to confirm your identity with us directly or confirm that you gave the agent permission.

No discrimination. We will not deny you service, charge you a different price or give you a lower level of service because you used your privacy rights.

16. Reviewing and Changing Your Information

To review the personal information we have about you or ask us to change it, email or call us at any time using the details in Section 15. If you created a customer account in our online store, you can also sign in to review and update some details.

17. Additional Information for California Residents

We are based in California and follow the California Online Privacy Protection Act. If the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the "CCPA"), applies to us, California residents have the right to:

• Know what personal information we collect, use and disclose, and get a copy of it;
• Delete personal information;
• Correct personal information;
• Opt out of the sale or sharing of personal information (we do not sell or share it);
• Limit the use of sensitive personal information (if we collect it, we use it only to verify your age, run your account, prevent fraud and meet legal duties, which the CCPA allows, and never to infer characteristics about you); and
• Not be discriminated or retaliated against for using these rights.

To make a request, follow the steps in Section 15.

What we collect. In the past 12 months, we collected these categories of personal information:

• Identifiers: name, email address, phone number, postal address and IP address.
• Customer records: billing and shipping details and limited payment details (such as card type and last four digits).
• Commercial information: products you bought, returned or asked about, and whether you chose shipping or in-store pickup.
• Internet activity: server logs, the technical details recorded with contact form messages (such as the page you sent it from and your browser type) and cookie data.
• Age information (a protected characteristic under California law): your confirmation at checkout that you are 21 or older, whether your age was verified if an age-verification service is used, and, for orders placed before November 11, 2026, the date of birth you gave at checkout.
• Visual information: photos you send us, such as photos of a damaged or wrong item.
• Sensitive personal information: your account login details, if you create a customer account, and, only if an age-verification service is used, details from your government ID, such as a driver's license or state ID number.

We collect this information from the sources in Sections 2 to 4, use it for the purposes in Section 5, and keep it as described in Section 12. In the past 12 months, we disclosed these categories for business purposes only to the types of recipients listed in Section 6. We did not sell or share any category of personal information, and we do not sell or share the personal information of consumers under 16.

"Shine the Light" requests. California residents may ask us, once per calendar year and free of charge, for information about any personal information we disclosed to third parties for their own direct marketing purposes in the prior calendar year. We do not make these disclosures. To ask, email service@tahoecbd.com with "Shine the Light Request" in the subject line, or write to us at the address in Section 21. We will reply within 30 days.

18. Residents of Other States

Several other US states have consumer privacy laws. Where those laws apply to us, and depending on where you live, you may have the right to confirm whether we process your personal information, to access, correct and delete it, to get a portable copy, and to opt out of its sale, targeted advertising and certain profiling. We do not sell personal information, use it for targeted advertising, or use it for profiling that leads to decisions with legal or similarly significant effects. Follow the steps in Section 15 to make a request.

Appeals. If we decline your request, you may appeal by emailing service@tahoecbd.com with "Privacy Appeal" in the subject line. We will respond within the time your state's law requires. If you disagree with the result, you may contact your state attorney general.

19. Links to Other Websites and Apps

Our website may link to other websites and apps, such as Google Maps for directions. We are not responsible for their content or privacy practices.

20. Changes to This Policy

We review this policy at least once a year and may update it from time to time. When we do, we change the "Last updated" date at the top. This version takes effect on November 11, 2026.

For material changes, we will post a notice on our website and may also email you. Changes take effect when posted unless we say otherwise. We will not use information we already have in a materially different way without first telling you and, where required, getting your consent.